output-guard: the forwarded tail must stay assistant-terminal-equivalent (output slice of fork e0f8fcb)

Path-scoped slice of fork commit e0f8fcb: the guard's fifth invariant
(assistant-terminal) and its tests. The same commit's
insertion-normalization tail guard belongs to the insertion slice (cnighswonger#272);
this slice carries the extension only as a sync, in the following commit.

Co-Authored-By: Claude opus-5 <noreply@anthropic.com>

Author: Gunther-Schulz

proxy/extensions/output-guard.mjs

@@ -86,12 +86,41 @@ function checkContentPresent(body) {
   return null;
 }
 
-const VALIDATORS = [checkToolAdjacency, checkMarkerBudget, checkRoles, checkContentPresent];
+// Invariant 5 (BACKLOG.md, "suppression can strip a request's FINAL
+// message", 2026-07-30): a message-REMOVING mutation shipped (duplicate
+// suppression) without a tail-validity check, and three live requests
+// ended assistant-role -> upstream "400 must end with a user message".
+// The other four invariants are shape-level facts about ONE body; this
+// one needs the body CC actually sent, so it takes it as a second
+// argument rather than deriving anything from `body` alone.
+//
+// Conditioned on the INCOMING shape rather than an unconditional "never
+// end assistant": if CC itself sent a request already ending in
+// assistant role (a prefill-style continuation, however rare in observed
+// traffic), that is the client's own intent and not this guard's business
+// to overturn — the guard protects against OUR mutations, not against CC.
+// `incomingBody` absent (e.g. the pre-mutation stash unavailable, or a
+// direct unit-test call) means "cannot verify" for this one check, so it
+// yields no violation rather than guessing.
+function checkAssistantTerminal(body, incomingBody) {
+  if (!incomingBody || !Array.isArray(incomingBody.messages) || incomingBody.messages.length === 0) return null;
+  const incomingLast = incomingBody.messages[incomingBody.messages.length - 1];
+  if (incomingLast?.role === "assistant") return null;
+  const forwardedLast = body.messages[body.messages.length - 1];
+  if (forwardedLast?.role === "assistant") {
+    return "assistant-terminal: incoming request ended non-assistant but the forwarded body ends assistant — a mutation stripped the trailing message";
+  }
+  return null;
+}
+
+const VALIDATORS = [checkToolAdjacency, checkMarkerBudget, checkRoles, checkContentPresent, checkAssistantTerminal];
 
-// Exported for tests: run all validators, return the first violation or null.
-export function findViolation(body) {
+// Exported for tests: run all validators, return the first violation or
+// null. `incomingBody` is optional — only checkAssistantTerminal reads it;
+// every other validator is unaffected by its absence.
+export function findViolation(body, incomingBody) {
   for (const v of VALIDATORS) {
-    const violation = v(body);
+    const violation = v(body, incomingBody);
     if (violation) return violation;
   }
   return null;
@@ -122,7 +151,7 @@ export default {
     ctx.meta = ctx.meta || {};
     let violation;
     try {
-      violation = findViolation(ctx.body);
+      violation = findViolation(ctx.body, ctx.meta._preMutationBody);
     } catch (err) {
       // Cannot verify -> pass the mutated body through (fail-open); a
       // guard crash must never break the request or the pipeline's value.

test/output-guard.test.mjs

@@ -100,6 +100,60 @@ test("findViolation: invalid role and empty content named", () => {
   assert.match(findViolation(b2), /content: messages\[3\]/);
 });
 
+// --- Invariant 5: assistant-terminal (BACKLOG.md, "suppression can strip
+// a request's FINAL message", 2026-07-30) ---
+
+test("findViolation: healthy body, incoming also ends non-assistant -> null (no incomingBody = cannot verify, also null)", () => {
+  const b = goodBody(); // ends on a tool_result (role user)
+  assert.equal(findViolation(b, b), null);
+  assert.equal(findViolation(b), null, "no incomingBody -> this check cannot fire");
+});
+
+test("findViolation: incoming ended non-assistant but forwarded ends assistant -> assistant-terminal named", () => {
+  const incoming = goodBody(); // last message role "user"
+  const forwarded = goodBody();
+  forwarded.messages.pop(); // simulate a mutation stripping the trailing tool_result
+  assert.equal(forwarded.messages[forwarded.messages.length - 1].role, "assistant");
+  assert.match(findViolation(forwarded, incoming), /assistant-terminal/);
+});
+
+test("findViolation: incoming ITSELF ended assistant (prefill-shaped) -> not this guard's business, no violation", () => {
+  const incoming = goodBody();
+  incoming.messages.push({ role: "assistant", content: [{ type: "text", text: "partial" }] });
+  const forwarded = structuredClone(incoming); // forwarded also ends assistant, matching CC's own intent
+  assert.equal(findViolation(forwarded, incoming), null);
+});
+
+test("findViolation: incoming and forwarded both end non-assistant -> null (healthy case)", () => {
+  const incoming = goodBody();
+  const forwarded = structuredClone(incoming);
+  assert.equal(findViolation(forwarded, incoming), null);
+});
+
+test("gate 2 (assistant-terminal): a mutator that strips the trailing message is caught, forwards the original, telemetry names it", async () => {
+  await withGuardEnv(async (dir) => {
+    const body = goodBody();
+    const originalHash = sha(body);
+    const ctx = { body, headers: { "x-session-id": "tail-strip-test" }, meta: { route: "messages" } };
+    const stripTailMutator = {
+      name: "test-strip-tail-mutator",
+      order: 300,
+      async onRequest(c) {
+        c.body.messages.pop();
+      },
+    };
+    await runOnRequest(ctx, [stash, stripTailMutator, guard]);
+
+    assert.equal(ctx.meta.outputGuardStats.fired, true);
+    assert.equal(ctx.meta.outputGuardStats.restored, true);
+    assert.match(ctx.meta.outputGuardStats.violation, /assistant-terminal/);
+    assert.equal(sha(ctx.body), originalHash, "forwarded body is byte-identical to the pre-pipeline original");
+
+    const events = await readFile(join(dir, "cache-fix-snapshots", "s-tail-strip-test-guard-events.jsonl"), "utf-8");
+    assert.match(events, /assistant-terminal/, "telemetry record names the violated invariant");
+  });
+});
+
 // --- Gate 1: zero fires on all healthy class corpora ---
 
 // The corpus COUNT is deliberately not pinned. It was (`=== 8`), and adding a